Age-restricted Purchases
Age-restricted purchases are transactions the law permits only above a set age — alcohol, tobacco and vaping products, gambling, firearms and ammunition, cannabis where legal, certain medicines, solvents, knives, and adult content. The restriction is on the sale, which places the obligation on the seller, and online that obligation has moved from glancing at a face to proving an age remotely.
| Common categories | Alcohol, tobacco and vaping, gambling, firearms and ammunition, cannabis, some medicines, solvents and knives, adult content |
| Who carries the obligation | The seller, not the buyer |
| Thresholds vary | By product, by country, and within the U.S. by state |
| U.S. tobacco and vaping | 21, federally, since 2019 |
| Typical penalties | Fines, loss of the permit to sell the category, and prosecution |
| Online challenge | No face to look at, and self-declared age is not a control |
| Regulatory direction | Toward demonstrable age assurance rather than a checkbox |
How enforcement works, and why online is different
In a shop the control is a person. A clerk forms a judgment about apparent age, asks for identification if unsure, and inspects the document. It is imperfect — and it has two properties online systems struggle to reproduce: the buyer is physically present, and the document is physically present.
Remove both and the problem changes shape. A self-declared date of birth is not a control; it is a formality that also produces a record of the site having asked. Regulators across several jurisdictions have moved decisively away from accepting it, and the direction of travel is toward assurance that can be evidenced.
The available approaches sit on a spectrum between friction and confidence:
| Method | Confidence | Cost to the buyer |
|---|---|---|
| Self-declaration | None | None |
| Payment card check | Weak — indicates an adult account, not the person present | Low |
| Database or credit-file lookup | Moderate; fails for thin-file and younger adults | Low |
| Facial age estimation | Moderate to good near the threshold; no identity captured | Very low |
| Document verification with biometric match | High | Higher |
Facial age estimation deserves the attention it gets, because it changes the economics. It returns an estimated age from an image without establishing identity, and it is accurate enough away from the threshold that the practical design is a buffer: estimate the age, pass anyone comfortably above the line, and route only those near it to a document check. Most buyers experience no friction and the store retains no identity data on them.
Why this matters for identity verification
Age-restricted retail has an unusually sharp version of a general problem. The seller needs to know one fact — is this person old enough — and has every reason not to collect anything more. Holding scans of customers’ identity documents to sell a bottle of wine creates a data liability far outlasting the transaction, and privacy regulators have been explicit about proportionality.
So the design goal is a threshold answer rather than an identity. Where a document check is warranted, the useful pattern is to verify, return the age assertion, and retain the minimum — not to build a customer identity file as a by-product of a purchase. That is the same constraint COPPA imposes from the other direction, and it is why data minimization is a design requirement here rather than a nice-to-have.
The check also has to bind to a person. A verified document proves an adult exists somewhere; it does not prove the adult is the one buying. That binding is a biometric comparison with liveness detection, without which a borrowed or breached document image passes cleanly — the online equivalent of borrowing an older sibling’s ID, and considerably easier. Age verification built on identity document verification is what makes the assertion defensible when a regulator asks how it was reached.
What age checks can’t do
A checkbox is not a control. Self-declaration records that the question was asked and provides no assurance whatsoever.
Verifying a document does not verify the buyer. Without a biometric binding, a document belonging to someone else works perfectly.
Thresholds are not universal. They differ by product, country and U.S. state, so a single global rule will be wrong somewhere — usually in the direction of non-compliance.
Estimation is a distribution, not a fact. Facial age estimation returns a range with error, which is why a buffer around the threshold matters and why it does not replace a document check for people near the line.
Delivery is a second gap. Verifying at checkout does not establish who accepted the package at the door, which is why some categories require age checks at handover as well.
Frequently asked questions
Is a date-of-birth checkbox enough for age-restricted sales?
No. Self-declaration provides no assurance and is increasingly unacceptable to regulators for restricted categories. It records that the question was asked, which is a documentation step rather than a control.
What is facial age estimation?
A technique that estimates a person’s age from an image without identifying them. It suits threshold decisions because no identity document is captured for the large majority of buyers, and it is typically deployed with a buffer — passing those comfortably above the age limit and routing anyone near it to a document check.
Do we have to store customers’ ID documents?
Generally no, and it is usually the wrong design. The requirement is to establish that the buyer meets the age threshold, not to build an identity record. Verifying, returning the age assertion, and retaining the minimum reduces both privacy exposure and breach liability.
Does verifying the document prove the buyer’s age?
Only if the document is bound to the person presenting it. A valid document establishes that someone of that age exists. A biometric comparison with liveness detection establishes that they are the one making the purchase.
Related reading
- Age verification — the control itself, and the methods available at each level of assurance
- COPPA — the same data-minimization tension, approached from the children’s privacy side
- Liveness detection — what binds a verified document to the person actually buying
- US online gambling laws — how age assurance obligations work in a heavily regulated category
